A vulnerability dubbed ‘CoSnitch’ allows Microsoft Copilot Personal to be manipulated into revealing sensitive internal details, raising major security concerns over prompt injection and data theft vulnerabilities.
Microsoft Copilot Personal can be nudged into revealing more about itself than it should, according to research from Varonis Threat Labs that exposed a flaw the company has dubbed “CoSnitch”. The team said it reported the issue to Microsoft in December 2025 and that Redmond planned to issue a fix and assign a CVE on Tuesday. The finding is notable because the researchers did not begin with reverse engineering; they persuaded the assistant to explain its own behaviour, then used those disclosures to demonstrate a one-click route to data exfiltration.
The attack centred on a URL parameter in Copilot’s web interface that previously allowed a pre-filled prompt to be passed straight into the assistant. Varonis said Microsoft later disabled that parameter to blunt prompt-injection attacks, but the researchers were able to get the model to discuss why automatic execution was impossible. By repeatedly asking why the mechanism would not work, they say Copilot exposed technical details, including an undocumented “autorun=1” parameter and the session conditions needed for it to fire. The researchers then tested the parameter as described and found that it still executed.
That behaviour opens the door to a straightforward phishing chain. A malicious link, delivered by email, SMS or a QR code, could launch Copilot in an authenticated session, trigger the hidden auto-run behaviour and submit an attacker-controlled prompt without any visible confirmation, according to the Varonis write-up shared with The Register. Once inside that session context, the prompt could be used to query connected services, including Gmail, Google Drive, Google Calendar and Copilot’s own chat history, or to inspect files and emails available to the user.
Security researchers have warned for months that Copilot-style assistants are vulnerable to prompt injection because they do not always separate untrusted content from system instructions. Windows Central reported earlier this year on related Copilot flaws, including “SearchLeak” and “Reprompt”, both of which involved URL parameters and one-click data theft. Malwarebytes and Tom’s Guide similarly described the 2026 “Reprompt” issue as a single-click attack that let malicious prompts ride inside Copilot links, while Microsoft later said it had patched that problem. Separately, researchers have also disclosed zero-click prompt injection against Microsoft 365 Copilot, underlining that the wider product family has faced repeated pressure at the boundary between usability and security.
Varonis senior security researcher Lior Adar said the problem is not limited to one personal AI product, arguing that the same architectural weaknesses can follow these tools into enterprise settings. He said the research showed how an assistant can be tricked into exposing internal parameters and configuration details, giving attackers a blueprint for automatic prompt execution. The deeper issue, he added, is that large language models still struggle to maintain a hard line between user data and system-level instructions, which means a malicious email or document can be treated as if it were a legitimate command.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
